Overview

overview

10

Static

static

94ff4db578...33.exe

windows7_x64

10

94ff4db578...33.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    94ff4db57862654ab6d3c556ae03f533

  • Size

    377KB

  • Sample

    220714-ew4hgagag9

  • MD5

    94ff4db57862654ab6d3c556ae03f533

  • SHA1

    6f052cd8cb59ae932bbe235a993c5e63a8aa078b

  • SHA256

    33b4058adaed65e17b07ee1c11af2c1a53e65dbd98f86cdfc72d841529160c14

  • SHA512

    83a0c02fe2211a8355584de69004f1edecbfdfb402c5c1955ad67ffe511bca5ddfa98410015926d1ef5c1de9e773ca4303c266da589a4f0c62fc51b0e83497c2

Score
10/10
ramnitbankerevasionspywarestealersuricatatrojanupxworm

Malware Config

Targets

    • Target

      94ff4db57862654ab6d3c556ae03f533

    • Size

      377KB

    • MD5

      94ff4db57862654ab6d3c556ae03f533

    • SHA1

      6f052cd8cb59ae932bbe235a993c5e63a8aa078b

    • SHA256

      33b4058adaed65e17b07ee1c11af2c1a53e65dbd98f86cdfc72d841529160c14

    • SHA512

      83a0c02fe2211a8355584de69004f1edecbfdfb402c5c1955ad67ffe511bca5ddfa98410015926d1ef5c1de9e773ca4303c266da589a4f0c62fc51b0e83497c2

    Score
    10/10
    ramnitbankerspywarestealertrojanupxwormevasionsuricata

    • Modifies firewall policy service

      evasion

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • suricata: ET MALWARE Known Hostile Domain ant.trenz .pl Lookup

      suricata: ET MALWARE Known Hostile Domain ant.trenz .pl Lookup

      suricata

    • suricata: ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup

      suricata: ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup

      suricata

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks